I am using helm charts to deploy some webhook handlers. The handlers need to connect to the cluster they are running on to deploy the configuration within it. It works but one step is tricky to move into the helm chart. When the chart makes the service account it gives it a randomly named secret:

$ oc describe sa sa-build-webhook-realworld
Name:                sa-build-webhook-realworld
Namespace:           your-eng2
Labels:              app=sa-build-webhook-realworld
Image pull secrets:  sa-build-webhook-realworld-dockercfg-4qz9g
Mountable secrets:   sa-build-webhook-realworld-token-bqtnw
Tokens:              sa-build-webhook-realworld-token-bqtnw
Events:              <none>

I can grab that and set it on the deployment config with:

    oc describe sa sa-tag-realworld |
    awk -F': *' '
        $2  { KEY=$1 ; VALUE=$2;  }
        !$2 {          VALUE=$1; }
        KEY=="Mountable secrets" && VALUE !~ /docker/ { print VALUE }
oc set volume dc/webhook-realworld \
  --add --name=sa-secret-volume \
  --mount-path=/sa-secret-volume \

I am trying to see if there is a way to do this declaratively in the chart yaml that creates the dc and sa at the same time which is here.

Is there a way to reference the generated service account secret from the deployment config in the chart?

Or should I be trying to get helm/helmfile to do the command-line lookup as part of its work?

1 Answer 1


Okay the answer to this is that you can set spec.serviceAccountName on the dc and the secrets are mounted.

Annoyingly the same does not hold true for BuildConfig objects. They have an inconsistently named spec.serviceAccount. Setting that doesn’t mount any secrets associated with the sa. It also means your build isn’t an “image puller” until you explicitly set that up. So this configuration option appears pretty useless as at openshift 3.11.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.